Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome lets hackers phish even 'Unphishable' Yubikey users

wired.com

Post reply on HN
Print view View original

41–50 of 113 posts

Re: Chrome lets hackers phish even 'Unphishable' Yubikey users

#41

Post by Shoothe »

crispyporkbites wrote: post #2

This is the attack: > If a victim logs into a fake Google site, the phishing site passes on their username and password to the real Google login page. Then the spoofed site passes back Google's request for the user's U2F token and collects the Yubikey's unique answer, all via WebUSB. When that answer is then presented to the real Google site, the attackers gain access to the victim's account. So basically they are so…

It's surprising that this works. Last time I checked WebUSB the device would have to have a descriptor allowing its use via web page effectively white listing what can be used on the web.

Re: Chrome lets hackers phish even 'Unphishable' Yubikey users

#42

Post by Ajedi32 »

tedunangst wrote: post #36
Ajedi32 wrote: post #33

Earlier quoted context omitted.

It's simple: allowing sandboxed code to request limited access to a USB device is more secure than having users install native, unsandboxed code with access to everything on their PC.

Assuming the sandbox works. If the sandbox is porous, the attack surface balloons from apps I choose to install to every link I click.

Not every link you click. Only sites that you grant access to the necessary attack surface. The Web USB API can't be attacked by sites that you haven't granted access to it.

Re: Chrome lets hackers phish even 'Unphishable' Yubikey users

#43

Post by Ajedi32 »

Sir_Cmpwn wrote: post #39
Ajedi32 wrote: post #33

Earlier quoted context omitted.

It's simple: allowing sandboxed code to request limited access to a USB device is more secure than having users install native, unsandboxed code with access to everything on their PC.

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chromium

As opposed to native desktop apps, which get all the same permissions by default that a web app requires a zero-day sandbox escape vulnerability to achieve?

Re: Chrome lets hackers phish even 'Unphishable' Yubikey users

#44

Post by Sir_Cmpwn »

Ajedi32 wrote: post #43
Sir_Cmpwn wrote: post #39

Earlier quoted context omitted.

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chromium

As opposed to native desktop apps, which get all the same permissions by default that a web app requires a zero-day sandbox escape vulnerability to achieve?

Native desktop apps are limited in number are nowhere near the dumpster fire the web is. My desktop isn't routinely downloading and executing payloads from the web. They're clearly different.

Re: Chrome lets hackers phish even 'Unphishable' Yubikey users

#45

Post by Ajedi32 »

Sir_Cmpwn wrote: post #44
Ajedi32 wrote: post #43

Earlier quoted context omitted.

As opposed to native desktop apps, which get all the same permissions by default that a web app requires a zero-day sandbox escape vulnerability to achieve?

Native desktop apps are limited in number are nowhere near the dumpster fire the web is. My desktop isn't routinely downloading and executing payloads from the web. They're clearly different.

This is about the Web USB API, not the entire web in general. Are you routinely granting web pages access to your USB devices? That's not a permission that web apps get by default (unlike with native desktop apps btw).

It comes down to this: if you ever found yourself in a situation where you needed to connect a USB device to a remote service, would you prefer to download that service's unsandboxed native code to your PC and execute it? Or execute some JS in the browser sandbox and grant it limited access to that one specific device?

Re: Chrome lets hackers phish even 'Unphishable' Yubikey users

#46

Post by Sir_Cmpwn »

Ajedi32 wrote: post #45
Sir_Cmpwn wrote: post #44

Earlier quoted context omitted.

Native desktop apps are limited in number are nowhere near the dumpster fire the web is. My desktop isn't routinely downloading and executing payloads from the web. They're clearly different.

This is about the Web USB API, not the entire web in general. Are you routinely granting web pages access to your USB devices? That's not a permission that web apps get by default (unlike with native desktop apps btw). It comes down to this: if you ever found yourself in a situation where you needed to connect a USB device to a remote service, would you prefer to download that service's unsandboxed native code to you…

>if you ever found yourself in a situation where you needed to connect a USB device to a remote service

I have never found myself in that situation. That sounds like a really silly idea.

Re: Chrome lets hackers phish even 'Unphishable' Yubikey users

#47

Post by Spivak »

Sir_Cmpwn wrote: post #46
Ajedi32 wrote: post #45

Earlier quoted context omitted.

This is about the Web USB API, not the entire web in general. Are you routinely granting web pages access to your USB devices? That's not a permission that web apps get by default (unlike with native desktop apps btw). It comes down to this: if you ever found yourself in a situation where you needed to connect a USB device to a remote service, would you prefer to download that service's unsandboxed native code to you…

>if you ever found yourself in a situation where you needed to connect a USB device to a remote service I have never found myself in that situation. That sounds like a really silly idea.

Attaching a bootable USB drive to a HTML5 based KVM? Sure it could be accomplished in other ways buy why not this way?

Re: Chrome lets hackers phish even 'Unphishable' Yubikey users

#48

Post by Sir_Cmpwn »

Spivak wrote: post #47
Sir_Cmpwn wrote: post #46

Earlier quoted context omitted.

>if you ever found yourself in a situation where you needed to connect a USB device to a remote service I have never found myself in that situation. That sounds like a really silly idea.

Attaching a bootable USB drive to a HTML5 based KVM? Sure it could be accomplished in other ways buy why not this way?

Why an HTML5 based KVM? A desktop app would be great for that!

Re: Chrome lets hackers phish even 'Unphishable' Yubikey users

#49

Post by Ajedi32 »

Sir_Cmpwn wrote: post #46
Ajedi32 wrote: post #45

Earlier quoted context omitted.

This is about the Web USB API, not the entire web in general. Are you routinely granting web pages access to your USB devices? That's not a permission that web apps get by default (unlike with native desktop apps btw). It comes down to this: if you ever found yourself in a situation where you needed to connect a USB device to a remote service, would you prefer to download that service's unsandboxed native code to you…

>if you ever found yourself in a situation where you needed to connect a USB device to a remote service I have never found myself in that situation. That sounds like a really silly idea.

Then click "deny", or (in the case of a native app) refuse to install the executable. Either way you're safe.

For those that _do_ require [such use cases][1] though; they can now do so without needing to expose their system to an unsandboxed native app.

[1]: https://wicg.github.io/webusb/#motivating-applications

Re: Chrome lets hackers phish even 'Unphishable' Yubikey users

#50

Post by Sir_Cmpwn »

Ajedi32 wrote: post #49
Sir_Cmpwn wrote: post #46

Earlier quoted context omitted.

>if you ever found yourself in a situation where you needed to connect a USB device to a remote service I have never found myself in that situation. That sounds like a really silly idea.

Then click "deny", or (in the case of a native app) refuse to install the executable. Either way you're safe. For those that _do_ require [such use cases][1] though; they can now do so without needing to expose their system to an unsandboxed native app. [1]: https://wicg.github.io/webusb/#motivating-applications

I know to do that. How about my grandma, who just clicks whatever button looks like it'll make the message go away sooner?

The web is a disaster and WebUSB is a prime piece of evidence supporting this.

Post reply on HN